Complete connect caller policy: RE-914–923
Ten separately committed tasks recover admission and completion policies and compose the entire original173979 QVM caller across926 paired source/Rust cases. The caller body executes, while bot admission, userinfo changes, team joining, ranking, engine buffers, files, logging and network sends remain supplied/captured boundaries. These finite policies do not establish native multiplayer acceptance or a complete playable game.
| Task | Evidence | Cases |
|---|---|---|
| RE-914 | Unsigned36306 comparison | 256 |
| RE-915 | Rust exact byte comparison | 256 |
| RE-916 | Address252643 parsing/filtering | 270 |
| RE-917 | Rust address/scratch policy | 270 |
| RE-918 | 173979 admission prefix | 160 |
| RE-919 | Rust admission order | 160 |
| RE-920 | 173979 completion suffix | 144 |
| RE-921 | Rust completion policy | 144 |
| RE-922 | Complete173979 caller | 96 |
| RE-923 | Rust complete caller composition | 96 |
Strings, addresses and admission
Actual36306 compares words but returns the unsigned-byte difference at the first differing character. It is case-sensitive, terminates at NUL and is distinct from the previously recovered69386 case-folded comparison. Fixtures cover four pointer alignments, embedded NUL, case and high-byte differences. Guard bytes are explicit fixture memory; arbitrary pointer validity/aliases remain open.
Actual252643 first compares the input with exact lowercase localhost and bypasses filtering on that match. Otherwise it constructs up to four bytes at a caller-stack word. Each numeric component wraps modulo256; any single non-digit separator advances the component index, while colon or NUL ends parsing. Short/empty strings leave explicitly supplied prior bytes in untouched components. Thus this body is not strict IP validation. The result is a little-endian word tested against mask/value entries at36275952/36275956 with stride12 and signed count36275948. Nonzero34082796 returns true on a match; zero mode returns true on a miss. Negative counts skip scanning. Table population, raw network provenance and actual scratch provenance remain open.
The173979 prefix fetches userinfo first. A nonzero bot argument bypasses both address and password checks. Other clients look up ip, invoke the actual filter and return exact Banned. text before any password lookup when rejected. If permitted, password is looked up even when the server password is empty. Nonempty server passwords are compared case-insensitively with none; other values invoke exact36306 comparison against the supplied password. Mismatch returns Invalid password. Rejection precedes entity/client initialization. Userinfo buffer selectors carry in the actual lookup order.
Completion ordering and partial rejection state
After the recovered initialize/restore branch, the caller normalizes team3096: team-classified modes replace zero with3; other modes replace values other than3 with0. Bot paths then set entity flag8 and in-use1 before requesting161744 with restart=!firstTime. A zero supplied result returns exact BotConnectfailed text after those mutations. The Rust policy preserves that ordinary rejection state; typed unsupported-domain errors stage state instead.
Successful first-time paths clear client668..695 and compute timeout3140 as clock+seconds*1000, with no initializer60-second default. They log, clear3588 and the3204..3587 message regions, then request171668 userinfo processing. Fixtures supply the resulting team/name changes. The first-time connection announcement uses that updated name and exact original70458/37914 formatting: the logical native command includes its print wrapper, quotes and newline. The Rust boundary removes the formatter's terminating NUL from its logical command bytes. A second team classification/decision observes the updated team, optionally requests182896 with choice-1, and5864 ranking is requested last. Native callback bodies and their arbitrary global effects remain open.
Whole caller composition
The96 complete original173979 executions combine admission, client/entity clear, actual247520 initialization or247219 restore, bot admission and completion. The corpus includes ordinary auth denial, localhost, partial addresses with supplied scratch, bot bypass/failure, negative new-session control, both lifecycle choices and mode0/3/9. Full6336-byte client checksums accompany watched words, the944-byte session block, entity state, exact messages, ordered events/cvar writes/reads and selector/formatter carry. The checksum is an FNV-1a coverage check, not a cryptographic identity claim.
Authentication denial leaves client/entity state intact. Bot rejection occurs later and retains prior lifecycle effects, including cvar/file intentions. Initialization can serialize timeout60100 before a first-time suffix overwrites the in-memory value with100; no second persistence write occurs in this caller. Stable engine userinfo snapshots are supplied across nested reads in this corpus. Mutating globals/counts between callbacks, raw VM pointer aliasing and native engine resource/network behavior remain outside the verified domain.
The new helper qvm_connect_policy_support.py has a distinct filename. Original packed string regions are seeded directly from the verified QVM image, including initializer literals needed by the whole-call composition. Independent Python state/event oracles and Rust parity caught logical string boundary issues before commit. No original game binary or asset payload was modified.
Validation
Every task ran focused cargo xtask test-group <name> before its own commit, with deterministic double regeneration, relevant source/Rust parity, scoped gameplay tests and storage/documentation/whitespace checks. Groups are qvm-byte-compare, rust-byte-compare, qvm-address-filter, rust-address-filter, qvm-connect-admission, rust-connect-admission, qvm-connect-tail, rust-connect-tail, qvm-connect-complete and rust-connect-complete. Shared admission/address/tail helpers also received focused regression checks.
Dependency-selection regression coverage includes the five new source/Rust report pairs, native_policy consumers and intermission/formatting dependencies. The existing health/session helper import smoke check remains in place. Every Python process uses the resolved Nix runtime declared by flake.nix, with explicit PYTHON for xtask and Git hooks. After commit ten, cargo xtask test-full --since 2b1ac7ec passed on its first full attempt: 1,783 Python tests and216 Rust tests (assets10, gameplay176, xtask30). All32 affected report producers regenerated twice deterministically. Storage policy, links across491 documentation files and whitespace checks passed with no generated-report drift. Validation notes were amended into task ten.
Follow-up work (expanded by RE-924–933)
- Recover161744 bot admission,171668 userinfo mutation and182896 team-join callback bodies, then compose them with173979 and actual5864 ranking/publication.
- Recover address-filter table writers and native IP/userinfo provenance; verify partial-address stack provenance, aliases, malformed counts and live configuration changes.
- Recover native logging/network/cvar/file-open and handle ownership, attach real engine adapters and validate actual connect/reload/failure behavior on macOS/Linux.
- Extend scalar/string domains: non-ASCII tails, uppercase exponents, remaining scanf conversions, oversized/fatal strings and native pointer boundaries.
- Compose both persistence children into series6939/readiness, native command dispatch, bot rotation/genetics and221662 map-list parsing.
- Replace supplied spatial-query answers with recovered native broadphase/world collision and compare native math.
- Compose complete respawn/intermission, event lifetime and scoreboard/network execution.
- Validate actual Linux/macOS Rust/Bevy/Solari gameplay/rendering. Full-game completion remains open.
RE-924–933 recovers bot settings, announcement and filter-insertion bodies and composes the connect children. Its RE-934 list supersedes the historical follow-up list above.